Sept 2026 Dev Stack Release Audit & Security Roundup

Early September 2026 has turned into one of the busier patch weeks in recent memory. A cluster of critical, unauthenticated remote-code-execution and account-takeover vulnerabilities landed almost simultaneously across container tooling, meta-frameworks, and identity platforms — alongside a wave of genuinely new features in edge computing, ORMs, and background-job systems. This roundup pulls together verified release notes, GitHub Security Advisories, and CVE records across 40+ tools so you can prioritize what to patch first.

Executive Summary

• Patch immediately: Next.js (unauthenticated RCE via Image Optimization API and a Windows-specific RCE, both fixed in 16.3.3/15.5.24), Keycloak (CVE-2026-18963, account takeover via password-reset bypass), Authentik (CVE-2026-49448, unauthenticated auth bypass), Nuxt (multiple critical server-island RCE/DoS bugs fixed in 4.5.1), PostgreSQL (28 CVEs fixed in the August rollup, several rated 8.8), Redis (CVE-2026-81934, TLS use-after-free), MongoDB (CVE-2026-18691, intra-cluster auth bypass), RabbitMQ (memory-exhaustion DoS and admin RCE advisories), and Docker/Podman (shared go-archive tar path-traversal, CVE-2026-17106).
• Breaking-change alerts: BullMQ v6 removed legacy repeatable-job APIs; NestJS 12 is ESM-first and needs Node 20.19+/22.12+; Prisma 8 (RC) replaces flat config with prisma.config.ts; Motion v13 dropped the @emotion/is-prop-valid dependency; Cloudflare D1's free-tier limits are now hard-enforced.
• Notable new capabilities: Next.js 16.3 "Instant Navigations," Vue 3.6's Vapor Mode (no virtual DOM) hitting RC, Cloudflare Workers' new 64 MiB uncompressed size limit, Vercel's AI Gateway adding several new models, Supabase's new Workers CLI suite, and Hono's first-class HTTP QUERY method support.
• End-of-life watch: Kubernetes 1.34 enters its final stretch (EOL 2026-10-27), Nuxt 3 reached end-of-life July 31, 2026, and Auth.js/NextAuth is now in maintenance mode with development handed to the Better Auth team.

Containers, Edge & Infrastructure

Docker (Engine, Compose, Desktop)

Engine v29.8.0 (Sept 3) adds a --umask flag and CloudWatch metadata to the awslogs logging driver, and folds in the fix for CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h — a path-traversal bug in moby/go-archive where a crafted tar archive with links could write files outside the intended extraction directory. Compose v5.5.1 improves lifecycle-hook logging, and Desktop v4.90.0 adds a persistent "Ask Gordon" AI side drawer and patches two CVEs (2026-46595, 2026-39834) via an updated Kind cloud-provider image. Upgrade Engine and Podman together — both share the affected tar-extraction code path.

Cloudflare (Workers, Pages, KV, R2)

Workers deploys just got significantly more headroom: as of Sept 4, Cloudflare replaced the old compressed-size caps (3 MB free / 10 MB paid) with a single 64 MiB uncompressed limit across all plans — good news for anyone shipping heavier framework bundles. Separately, D1's free-tier row-read/row-write limits are now hard-enforced rather than soft-throttled, resetting daily at midnight UTC. No notable R2/KV changes this week.

Vercel

Vercel's rolling changelog highlights AI Gateway growth (GPT-6 Astra, Gemini 3.8 Flash, and others added, with per-user spend budgets), a new cheaper "Basic" 2 vCPU/8 GB build machine tier for Pro/Enterprise teams, and Cursor Cloud Agents now running inside Vercel Sandbox's isolated microVMs. Full log: vercel.com/changelog.

Kubernetes & Podman

Kubernetes' active branches are 1.37, 1.36, and 1.35; 1.34 shipped its final patch (1.34.11) on Aug 11 and enters full EOL on Oct 27, 2026 — plan upgrades now. See kubernetes.io/releases. Podman v6.1.1 (Sept 2) ships the same go-archive tar-traversal fix as Docker, plus rootless dual-stack port-binding fixes.

AWS, Railway, Render

AWS's Sept 7 weekly roundup covers new Graviton5-based R9g/R9gd instances (up to 25% more compute), Lambda SnapStart extended to container images, and an Amazon Linux kernel bulletin for a cluster of "DirtyFrag"-class CVEs (2026-31431, 2026-43284, 2026-43500). Railway's Sept 4 changelog adds railway postgres CLI commands for HA cluster management and point-in-time recovery. Render's changelog adds a full deploy-history page and a new "flex" pay-for-what-you-use compute plan for Workflows — see render.com/changelog.

Identity & Authentication (IAM)

Keycloak

Keycloak 26.7.3 (Aug 31) rolls up roughly 20 fixes, headlined by CVE-2026-18963, rated CVSS 9.1: an unauthenticated attacker could force a password reset for any user without the victim clicking the email-verification link, enabling account takeover. Also fixed: LDAP hostname-verification bypass, OIDC/JWT assertion-policy gaps, and exposed reCAPTCHA secrets. Upgrade to 26.7.3 (or the 26.4.15/26.6.6 backports) immediately.

Authentik

Authentik 2026.8 adds enterprise Privileged Access Management with approval workflows, Agent Accounts, and scheduled user offboarding. Its most urgent recent fix is CVE-2026-49448, rated CVSS 9.8 — an unauthenticated Source-stage auth bypass triggerable via an empty POST request, patched in 2025.12.6/2026.2.4/2026.5.1. Note two CLI/behavior breaking changes: hash_password no longer accepts a password argument, and forwarded headers are only honored from configured trusted proxies now.

Clerk & Auth0

Clerk shipped a steady cadence of SDK patches (@clerk/nextjs 7.9.1, Sept 3) plus new admin features: a configurable reverification window and an Admin Logs audit trail. Its most serious recent disclosure, CVE-2026-41248 (CVSS 9.1), was a middleware route-protection bypass across @clerk/nextjs, @clerk/nuxt, and @clerk/astro — confirm you're past the April 2026 patched versions. Auth0 (a continuously-deployed SaaS) reached GA on configurable Advanced MFA settings (device-memory window, OTP length/lifetime) on Sept 1, and put My Organization API / Cross-App Access into Early Access.

Better Auth & Auth.js (NextAuth)

Better Auth 1.7.3 (Sept 6) adds Cloudflare as a built-in social provider and now validates schemas by default in production. The project has had an unusually active disclosure cadence — a June cluster included a critical SCIM account-takeover bug and an SSRF exposing cloud metadata (CVE-2026-53513, CVSS 9.6) — worth reviewing if you're on an older 1.6.x release. Meanwhile, Auth.js/NextAuth is now in maintenance mode, with the Better Auth team handling its security fixes; the last release was [email protected] in July.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js 16.3.4 is the current stable, but the headline story is the August 2026 Security Release: two critical, unauthenticated RCEs — one via the Image Optimization API's AVIF handling (GHSA-2xp9-vwfh-vxw4), one affecting Windows-hosted servers using both routers without Cache Components (CVE-2026-75604) — fixed in 16.3.3 and 15.5.24 with no workaround available. On the feature side, 16.3 shipped "Instant Navigations" (Cache Components, up to 90% less dev-server RAM via Turbopack memory eviction) and native Node.js streams for SSR. React itself is quiet: 19.2.8 is a small RSC-decoding perf patch; no new advisories in the last month.

# Recommended immediate upgrade
npm install [email protected]

Nuxt & Vue.js

Nuxt 4.5.1/3.21.10 was a five-vulnerability security release, two critical: a server-side RCE via runtime template injection in server-island props (CVE-2026-71320) and unauthorized component instantiation with no special config required (CVE-2026-71318). Nuxt recommends purging CDN/edge caches after upgrading due to a related cross-user payload-disclosure fix. Nuxt 3 reached end-of-life July 31, 2026. Vue 3.6 is in RC with Vapor Mode — a no-virtual-DOM compilation path — now feature-complete and benchmarking on par with Solid.js and Svelte 5.

SvelteKit & Svelte

Svelte 5.57.0 adds SvelteMap.getOrInsert/getOrInsertComputed and a has() check on createContext. SvelteKit 2.70.3 fixes an eager $app/state dependency-read bug; 2.70.2 closed a quadratic-backtracking DoS-adjacent issue in Accept-header parsing. SvelteKit 3 is in prerelease with a migration guide at next.svelte.dev.

Astro

Astro 7.3.1 (Sept 3) is a same-day hotfix for a startup/build regression in astro:assets introduced by 7.3.0, which itself added an --ignore-lock flag for running concurrent preview servers and improved multi-module build performance.

Backend Frameworks & Runtimes

Node.js & NestJS

Node.js v26.8.1 adds SIV/GCM-SIV cipher modes and new zlib ZIP APIs; the most recent security batch was July 29 (HTTP/2 header memory accounting). NestJS 12 is a breaking, ESM-first major release — Node 20.19+/22.12+ required, Rspack replaces the old bundler by default, and it adds native Standard Schema validation (Zod/Valibot/ArkType) directly in @Body()/@Param() decorators.

Fastify & Express

Fastify shipped two security releases in three weeks: v5.12.2 (Sept 4) patches four high-severity advisories around not-found-handler and validation bypasses, following v5.12.1 (Aug 18) which fixed a schema-coercion bypass and X-Forwarded-* spoofing under trustProxy. Express's own July 31 security release addressed GHSA-v422-hmwv-36x6 in body-parser — an invalid limit value silently disabled request-size enforcement, opening a DoS vector; fixed in body-parser 1.20.6/2.3.0.

ElysiaJS & Hono

ElysiaJS's 1.4.x line is now security-fixes-only (v1.4.30, Aug 26) while active development moves to Elysia 2 "DayDream" (currently in beta), which adds ahead-of-time compilation the maintainer benchmarks at roughly 2x faster. Hono v4.13.7 (Sept 4) builds on 4.13's new first-class app.query() support for the HTTP QUERY method (RFC 10008) and a proper Method-Not-Allowed middleware with correct Allow headers.

FastAPI, Django & Laravel

Django 6.1.1 (Sept 2) fixes several 6.1 regressions around ModelAdmin multi-relation lookups and Prefetch database routing; its most recent security release (Feb 2026) patched three SQL-injection CVEs, including one via QuerySet.order_by() combined with FilteredRelation. Laravel v13.30.1 (Sept 1) adds insertOrIgnoreReturning() and dropVectorIndex() to the schema builder; its notable recent advisory, GHSA-crmm-hgp2-wgrp, covered signed-URL path confusion on the local filesystem driver. FastAPI's latest, v0.141.0, adds app.frontend(check_dir="auto") for simpler local dev.

UI Systems, Styling & Motion

shadcn/ui & Radix UI

The shadcn CLI reached 4.21.0 (Sept 4), and the ecosystem's biggest recent change is the new standalone cn package replacing the old copy-pasted twMerge(clsx(...)) helper — run pnpm dlx shadcn@latest migrate cn to adopt it. Radix's unified radix-ui package sits at 1.6.7, with fixes for broken ARIA references on Dialog and a Toast Escape-key bug; see releases.

Tailwind CSS & Material UI

Tailwind CSS v4.3.3 added --watch --poll[=ms] CLI support and fixed Preflight overriding Firefox's native iframe:focus-visible. MUI v9.4.0 (Aug 27) adds an opt-in theme.focusVisible for a consistent keyboard focus ring and lets Tooltip wrap disabled buttons without an extra <span>.

Motion

Motion v13.2.0 (Sept 2) — the freshest release across this whole styling/motion group — adds animate.addEffect() for driving non-DOM subjects, plus a new motion/three integration for Three.js objects and shader uniforms. Note the earlier v13.0.0 breaking change: @emotion/is-prop-valid was dropped in favor of an explicit isValidProp prop on <MotionConfig>.

Databases, Caching & Vector Search

PostgreSQL & pgvector

The Aug 13 PostgreSQL rollup (18.6/17.11/16.15/15.19/14.24) fixed 28 CVEs, several rated CVSS 8.8, including heap buffer overflows in regexp, to_char, and pg_dump, plus a SQL-injection path via EXTRACT argument deparsing (CVE-2026-15741). If you're running any supported major version, this is a same-week upgrade. pgvector v0.8.6 fixed a 32-bit IVFFlat build buffer overflow.

# Debian/Ubuntu example — check your major version first
sudo apt update && sudo apt install postgresql-17

Redis & MongoDB

CVE-2026-81934 is a use-after-free in Redis's TLS pending-data processing that could enable RCE under specific authenticated conditions; fixed across the 6.2–8.10 line. MongoDB's Aug 11 security release (8.0.29) fixed the critical CVE-2026-18691 (CVSS 9.0), an improper-authentication flaw in intra-cluster connections affecting Server 7.0, 8.0, and 8.3 — with a further wave of driver-level CVEs (C, PHP, C# drivers) disclosed September 3.

ClickHouse & DuckDB

ClickHouse's new 26.8 LTS line changes max_insert_threads to default to auto (parallel inserts by default) and adds SQL pipe operators (FROM t |> WHERE x > 1). DuckDB's latest, v1.5.5, backports out-of-bounds security fixes; a v2.0 release with async Parquet/CSV I/O is reportedly planned for later this year.

Database Tools, ORMs & BaaS

Prisma & Drizzle

Prisma is running two tracks at once: stable 7.10.0 hardens Prisma Studio's local dev server (now binds to 127.0.0.1 only and drops wildcard CORS), while Prisma 8 RC.13 previews a breaking config overhaul (prisma.config.ts replaces flat config) and renames .take()/.skip() to .limit()/.offset(). Drizzle's active line is the 1.0.0 release-candidate (rc.5), which adds JIT query mappers for a claimed 25–30% latency reduction; its most notable security fix remains CVE-2026-39356, a SQL-injection risk in escapeName() fixed in 0.45.2/1.0.0-beta.20.

Supabase & Firebase

Supabase CLI 2.117.0 and supabase-js 2.116.0 both shipped September 7 with a new experimental supabase workers command suite and MFA recovery-codes support. Firebase's JS SDK 12.18.0 removed the now-shut-down Imagen model methods (migrate to Gemini's image models), and a Sept 1 pricing change introduced usage-based billing for Remote Config beyond 100k free daily fetches.

Background Jobs, Messaging & Task Queues

BullMQ, RabbitMQ & Kafka

BullMQ v6.3.4 bumps a Rust dependency (croner) flagged by maintainers for a security issue; note that BullMQ v6 already removed legacy repeatable-job APIs (repeat option, Repeat class) as a breaking change. RabbitMQ 4.3.5 was followed a day later by a batch of advisories including GHSA-cfqc-c682-93mm — an unauthenticated WebSocket-compression memory-exhaustion DoS in Web STOMP — and a moderate admin-to-RCE escalation path via Erlang distribution. Kafka's latest, 4.3.1, is a bugfix release for a Streams RocksDB memory leak.

Temporal

Temporal server v1.31.2 backports a fix for CVE-2026-5724, a missing-authentication gap in the frontend gRPC replication-streaming endpoint — operators running replication with authorization enabled should check the release notes for the system.disableStreamingAuthorizer guidance. On the product side, Serverless Workers for AWS Lambda entered Public Preview in early August.

What to Do Today

• Patch Next.js, Keycloak, Authentik, Nuxt, PostgreSQL, Redis, MongoDB, and Docker/Podman first — all have unauthenticated critical-severity issues with public advisories.
• Audit RabbitMQ and Fastify deployments against the advisories above; both shipped multiple fixes within days of each other.
• Plan the Kubernetes 1.34 → 1.35/1.36/1.37 migration before its Oct 27 EOL, and budget time for the Nuxt 3 → 4 and Auth.js → Better Auth migrations given both are now unmaintained.
• Track the RC tracks — Prisma 8, Drizzle 1.0, Vue 3.6, and SvelteKit 3 are all close enough to stable that pinning to a specific RC now avoids a scramble later.

This roundup was compiled from official release notes, GitHub Security Advisories, and CVE/NVD records current as of September 8, 2026. Always verify against the linked primary sources before patching production systems.